Dependabot security alerts for bruno-cli

Internal - [SEC-13]

I have checked the following:

• I have searched existing issues and found nothing related to my issue.

This bug is:

• Making Bruno unusable for me.
• Slowing me down but I'm able to continue working.
• Annoying.
• This feature was working in a previous version but is broken in the current release.

Bruno version

4.1.0

Operating System

Others (Please specify below)

Specific OS Version / Distro

Dependabot / GitHub actions

Describe the bug

Context

We use bruno-cli as part of a CI process, to build documentation in bruno format from an OpenAPI specification

Problem

Dependabot runs periodically in our repository, scanning the package-lock.json file. As of this writing, it has raised 11 alerts, 10 of which (including 4 high severity) cannot be resolved due to conflicting dependencies.

• Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning (High)
• Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios (Moderate)
• Axios: Nested axios option objects can consume polluted prototype values (Moderate)
• Axios: Prototype pollution auth subfields can inject Basic auth (Moderate)
• Axios: Prototype pollution gadgets can alter axios request construction (Moderate)
• Faker: helpers.fake exploitable into arbritary code execution (High)
• form-data: CRLF injection in form-data via unescaped multipart field names and filenames (High)
• nanoid: Integer Overflow or Wraparound (High)
• node-csv: Prototype replacement still reachable via columns path (Moderate)
• uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided (Moderate)

Steps to reproduce

1. Create a package.json file with following contents

   {
     "private": true,
     "devDependencies": {
       "@usebruno/cli": "^4.0.0"
     }
   }
   

2. generate package-lock.json

   npm i --package-lock-only
   

3. Let Dependabot do its thing. Or just run npm audit

Collection to reproduce

No response

Screenshots/Live demo link

N/A